05.01.2022
It is well known that legal protection in data protection matters is a two-track process (firstly, there is the option of addressing a complaint to the data protection authority, and secondly, there is the option of addressing the civil courts in accordance with Section 29 of the Data Protection Act). The problem is that the administrative complaint procedures, which must first be conducted before the data protection authority and then, if necessary, before the Federal Administrative Court (Section 27 of the Data Protection Act) or the courts of public law, are conducted at the applicant's own expense. There is generally no right to reimbursement of costs. The applicant, who has already suffered a data protection violation, is initially left to cover his own costs, even if the data protection authority or the Federal Administrative Court find a violation of the fundamental right to data protection.
The Linz Higher Regional Court has recently made a groundbreaking decision (2 R 149/29a of November 10, 2021). The facts are quickly explained: An Austrian district authority had issued a decision regarding an officially ordered compulsory shooting of hawks in a cooperative hunting area. This decision also contained personal data of the representatives of the hunting association, namely in particular their names, postal and e-mail addresses, as well as their function (see the facts reproduced in detail in the decision of the Federal Administrative Court W258 2227120-2/4E of April 16, 2020). This decision (which the operator of the website had received on the basis of the relevant provisions of the Environmental Information Act) was published in full text, also showing this personal data, by a conservationist on the Internet.
A representative of the hunting association did not want this and complained to the data protection authority about this publication. He was not bothered by the publication of the decision per se, but was of the opinion that his personal data was not covered by free access to environmental information, and that its publication should therefore be checked against the data protection regulations.
The data protection authority upheld the complaint. The disclosure of the hunter's identity would not be justified, as the data in question was not generally available. The complainant's right to confidentiality would therefore have been violated. The website operator appealed to the Federal Administrative Court, but confirmed that the district gamekeeper and hunting director of the hunting association had had his right to data protection violated. The Federal Administrative Court admitted to the critical website operator that the personal information could in any case be brought together indirectly via research on the Internet (by researching the hunting association's websites and combining this information with the information on the state hunting association's website). However, this does not change the fact that the admissibility of the use of personal data contained in information provided via an application under the Environmental Information Act depends on compliance with the relevant data protection provisions. A balancing of interests would have to be carried out in accordance with Section 1 Paragraph 2 of the Data Protection Act. In the present case, this tipped in the hunter's favor.
So far so good - of course: The gamekeeper had spent an amount of € 1,649.34 on his representation in the data protection authority proceedings, which had not been decided on in the administrative authority proceedings due to a lack of legal basis. He now turned to the Regional Court of Wels and demanded reimbursement of these costs. He had claimed that his right to data protection had been violated, and that the defendant operator of the website had acted negligently and therefore culpably and unlawfully. The defendant operates a private homepage, which is why he does not fall under the media privilege under Section 9 of the Data Protection Act and is therefore liable for damages. Article 82 of the GDPR, which states that a data subject who suffers a violation of the GDPR and who must therefore be compensated for any material and immaterial damage, would be the legal basis for the claim for reimbursement of costs. Unsurprisingly, the defendant contested these arguments, arguing in particular that he was a voluntary nature conservation body, that the media privilege of Section 9 DSG applied (note: to put it simply, this significantly restricts the application of the GDPR to media companies or media services), and that the administrative procedure, in which he had merely expressed a justifiable legal opinion, simply did not provide for reimbursement of procedural costs.
The court of first instance upheld the claim. According to Section 29 Paragraph 1 DSG and Article 82 GDPR, a person whose rights have been violated is entitled to compensation. Due to the unlawful publication of the plaintiff's data, the defendant is obliged to pay compensation, and because the defendant did not invoke the media privilege in the administrative proceedings, this question can also remain open. The Linz Higher Regional Court also took this legal view. The relevant provisions of the GDPR and the DSG do not say anything about whether a person responsible under Article 4 Paragraph 7 GDPR, such as the defendant as the operator of the website, has to reimburse administrative representation costs on the basis of general tort law principles (Sections 1293ff ABGB) or on the basis of special compensation regulations (Article 82 GDPR). The Linz Higher Regional Court initially referred to the consistent case law of the Supreme Court, according to which the independent assertion of administrative procedure costs in ordinary legal proceedings is generally excluded. However, there is the (important here) exception that in cases of so-called "rescue costs", reimbursement of costs is indeed due. Rescue costs are therefore defined as costs incurred in administrative proceedings in order to avert a danger, in particular those that threaten due to unlawful and culpably false information provided by a third party to the administrative authority. In other words: If false information is provided in administrative proceedings intentionally or at least with gross negligence, and if this results in "rescue" costs for someone else in these administrative proceedings (this can in particular be legal costs), then these costs must be reimbursed. This would also be the case here: the main reason for the claim for damages would be the violation of data protection law through the publication of the plaintiff's personal data, which the website operator refused to remove. In addition, the defendant did not rely on the media privilege under Section 9 of the Data Protection Act in the administrative proceedings. The civil court is, of course, bound by final decisions of an administrative authority by which the latter has made a final decision on a preliminary question relevant to the civil court, even if these decisions are incorrect.
The basic idea behind the decision is to be welcomed: a controller who violates a data subject's right to data protection should also be liable for any damage caused as a result.
The legal opinion (although expressed in accordance with case law and literature) according to which the civil courts should be (unconditionally) bound by the decisions of the data protection authority and the higher courts of public law, regardless of the dual-track legal protection of the GDPR, is problematic, even if an essential issue (as in this case: the question of the applicability of the media privilege under Section 9 DSG) has not been discussed before the administrative authority. The lesson from this decision is in any case that in case of doubt all arguments must be presented in detail in administrative data protection proceedings, since the administrative proceedings under data protection law can be followed by civil proceedings under tort law.